JVN#53886050 Vulnerability in La!cooda WIZ and LacoodaST allowing an arbitrary PHP script execution

Overview

La!cooda WIZ and LacoodaST contain a vulnerability which may allow a malicious user to execute an arbitrary PHP script on the server.

Products Affected

La!cooda WIZ 1.4.0 and earlier
LacoodaST 2.1.3 and earlier

For more information, refer to the vendors' websites.

Description

La!cooda WIZ from System Consultants Co., Ltd. and LacoodaST from SpaceTag, Inc. are groupware providing schedule and task managements, etc. La!cooda WIZ and LacoodaST contain a vulnerability which may allow a malicious user to execute an arbitrary PHP script on the server.

Impact

If an arbitrary PHP script is executed, files on the server could be deleted or disclosed.

Solution

Update the Software
Apply the latest updates provided by the vendors.
For more information, refer to the vendors' websites.

Vendor Status

Vendor	Link
System Consultants Co., Ltd.	About multiple vulnerabilities in La!cooda WIZ
SpaceTag, Inc.	About multiple vulnerabilities in LacoodaST

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.08.21

Measures	Conditions	Severity
Access Required	Routed - can be attacked over the Internet using packets	High
Authentication	Standard - login caused to be created by an administrator	Low-Medium
User Interaction Required	None - the vulnerability can be exploited without an honest user taking any action	High
Exploit Complexity	Low - little to no expertise and/or luck required to exploit (cross-site scripting)	High

Description of each analysis measures

Credit

Hirotaka Katagiri reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE	CVE-2008-3737
JVN iPedia	JVNDB-2008-000049